calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below contain a Path Traversal vulnerability that allows arbitrary file writes anywhere the user has write permissions. On Windows, this leads to Remote Code Execution by writing a payload to the Startup folder, which executes on next login. Function extract_pictures only checks startswith('Pictures'), and does not sanitize '..' sequences. calibre's own ZipFile.extractall() in utils/zipfile.py does sanitize '..' via _get_targetpath(), but extract_pictures() bypasses this by using manual zf.read() + open(). This issue has been fixed in version 9.3.0.
The extract_pictures() function verifies only whether the path in the ZIP archive starts with the string 'Pictures', but does not neutralize '..' sequences (path traversal). The built-in ZipFile.extractall() method in utils/zipfile.py has appropriate sanitization through the _get_targetpath() function, however extract_pictures() completely bypasses it — using direct calls to zf.read() and open(). An attacker can prepare a malicious e-book file with a ZIP archive containing crafted paths and trick the user into opening it. On Windows systems, writing the payload to the Startup folder results in its automatic execution on the next user login.
An attacker can write arbitrary files to locations where the user has write permissions, and on Windows systems achieve remote code execution (RCE) in the context of the logged-in user.
Calibre should be updated to version 9.3.0, in which the issue has been fixed. The patch is available in the official project repository (commit e1b5f9b45a5e8fa96c136963ad9a1d35e6adac62).
Calibre in versions 9.2.1 and earlier on all supported platforms; the RCE scenario applies particularly to Windows systems.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCalibre Ebook Calibre
APPCalibre-Ebook< 9.3.0
Related vulnerabilities
Path Traversal w Calibre — zapis dowolnych plików przez czytnik PDB
Privilege escalation przez argument injection w Calibre (linux_mount_helper.c)
Calibre: eskalacja uprawnień do root przez untrusted search path
calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to ...
calibre is an e-book manager. Prior to 9.2.0, Calibre's CHM reader contains a path traversal vulnerability tha...